Ask the privacy officer at most Indian tech companies about DPDPA compliance. You will get a version of the same answer: “We are getting ready.” Translation for many: not much yet. The law now has rules and an enforcement body. But penalty-backed enforcement is still ramping up, and companies are pacing their spending accordingly.
The short answer: India’s DPDPA became law in 2023. Its rules were finalised and notified on 13 November 2025, and the Data Protection Board of India has now been formally established. But the Board’s core penalty powers and most compliance duties phase in through 2027, so 2026 is largely a “soft enforcement” year. Your rights still exist today, and you can exercise many of them by writing directly to a company’s grievance officer.
India’s Digital Personal Data Protection Act became law in August 2023. It passed Parliament, received Presidential assent, and generated a wave of compliance seminars and explainer articles. For nearly two years, what it did not generate was meaningful enforcement. That is now changing, but slowly.
Is the DPDPA being enforced yet?
The DPDPA created a body called the Data Protection Board of India (DPBI). The DPBI receives complaints, investigates violations, and imposes penalties. Without it operating, the law has little bite in practice.
Here is where things stand in mid-2026. The DPDP Rules were notified on 13 November 2025. Those rules cover how the Board is established, how complaints are filed, and how investigations run. The government has formally established the four-member Board, headquartered in the National Capital Region.
But establishment is not the same as full enforcement. The Board’s core powers to investigate and penalise, along with most substantive duties for companies, phase in over an 18-month transition. The consent-manager rules take effect around November 2026. The main compliance obligations follow in 2027. So 2026 is widely treated as a “soft enforcement” year, focused on guidance rather than fines.
Companies know this. Their legal teams track it. Many are making a deliberate calculation: heavy compliance spending is a 2027 problem.
What the DPBI does
Once its powers are fully in force, the DPBI is the central enforcement mechanism for Indian data protection law.
Its mandate covers adjudicating complaints from individuals whose rights were violated. It investigates companies on its own initiative when violations are suspected. And it imposes financial penalties. The maximum penalty under the DPDPA is ₹250 crore per incident, roughly $30 million. For a company holding millions of users’ data, that is a serious number.
One procedural detail matters for individuals: under the rules, you first raise a grievance with the company. Only if it goes unresolved (the rules point to a 90-day window) can you escalate the complaint to the Board.
The board is modeled partly on GDPR’s Data Protection Authorities (DPAs) — the national regulators in EU member states that enforce Europe’s data protection rules. Ireland’s DPA, for example, is the lead regulator for Meta, Google, and Apple (all EU-headquartered). It has levied billions in fines.
That’s the model. India isn’t there yet.
Where enforcement stands now
Here is the honest picture as of mid-2026.
The DPDP Rules are notified and the Board is established. But the DPBI has not yet issued major fines under the DPDPA. Its core penalty powers and most company duties are still phasing in through 2027. So the near-term reality is guidance and preparation, not headline penalties.
One piece of enforcement infrastructure has been active for years: CERT-In’s 6-hour breach notification requirement. Companies must report significant data breaches to India’s cybersecurity agency within 6 hours of discovery. This predates the DPDPA and operates separately from it. It is real, and some companies have been pulled up for non-compliance.
But CERT-In’s mandate is national cybersecurity, not individual privacy rights. If your data gets sold by a telecom company or scraped by a data broker, CERT-In is not the body you would complain to.
What this means for companies
The enforcement gap creates a perverse incentive.
Companies that updated their privacy policies after August 2023 deserve credit for the paperwork. Most stopped there. Actual data practices — how long data is retained, who it’s shared with, whether erasure requests are processed — remain largely unchanged. Grievance officers are listed on websites because the law requires it. Whether those officers actually respond to requests is another question.
Some larger Indian tech companies and multinationals with GDPR exposure have done genuine compliance work. GDPR penalties are real and enforceable now, which creates pressure that cascades into global privacy practice. But a domestic startup collecting your data for a fintech app? The calculus is different. Why spend on compliance infrastructure for a regulator that hasn’t penalized anyone?
This isn’t cynicism — it’s rational behavior under the current incentive structure.
What you can still do
The DPDPA gives you rights regardless of whether the DPBI is enforcing them. And some of those rights can be exercised directly.
Right to access and right to erasure can be triggered by writing to a company’s grievance officer. Every Data Fiduciary must appoint one under Section 13 of the act. This obligation applies to all Data Fiduciaries, not just Significant Data Fiduciaries. You do not need the DPBI to exercise these rights. You write the letter, and they are legally obligated to respond.
Practically, many companies will not respond promptly. Some will not respond at all. But the legal obligation exists, and documented non-response strengthens any future complaint once the DPBI’s powers are fully in force. You are building a paper trail.
For a step-by-step guide on actually exercising these rights — what to write, who to contact, what to do when they ignore you — read our DPDPA rights practical guide.
The GDPR comparison: this changes
GDPR became law in May 2018. For the first two years, enforcement was slow. Fines were small. Companies hedged. Privacy professionals inside large companies struggled to get budget.
Then, in May 2023, Ireland’s Data Protection Commission fined Meta €1.2 billion for transferring EU user data to the US without adequate safeguards. Suddenly, every board of directors in Europe had a data protection agenda item. Privacy teams got headcount. Compliance budgets appeared.
India is following a similar trajectory. The DPBI is now established and its powers are phasing in. The first large enforcement action, probably against a major platform or a telecom operator, will reshape how Indian companies think about data privacy overnight.
The companies building genuine DPDPA compliance now will be ready. The companies treating it as optional will scramble. That’s not speculation; it’s what happened in Europe, and the incentive structures are the same.
The question isn’t whether DPDPA enforcement arrives. It’s when — and whether your data will be better protected by then, or still sitting in dozens of databases you’ve never authorized.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.